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Data Protection Good Practice Note 


Use of ID scanning devices in pubs and clubs 


Licensees are required to make sure they do not serve alcohol to anyone 
under the age of 18. Some club and pub owners, particularly those with 
premises attracting a younger clientele, are keen to demonstrate that they are 
taking appropriate precautions to avoid serving under-age drinkers and are 
collecting and retaining identity information using scanning equipment. This 
guidance sets out what licensees wishing to operate in this way need to do to 
comply with the Data Protection Act 1998 (the Act). 


ID scanning equipment providers will have supplied user literature and 
practical assistance to its customers and are likely to be able to offer further 
ongoing support. This guidance provides a number of tips to help pubs and 
clubs use ID scanning equipment in a manner which respects customer 
privacy and meets the good practice recommendations in the Act. 


e You should design display signs and prominently place them close to 
the entrance of premises explaining simply and clearly why the ID 
system is in operation and if any sharing with other schemes (such as 
Pub Watch) is involved. 


e You should also explain on the display signs any intended marketing 
use of customer names and addresses by the club. You should deal 
promptly with requests not to receive promotional material. You will 
need clear consent for disclosures of customer details to others for 
their marketing purposes. 


e Handy credit card sized notices can be distributed at the door to 
reinforce the above messages. 


e We understand that scanning equipment is designed not to capture 
excessive amounts of information. However, scanning operators should 
make sure they only take relevant information from the documents 
presented at the door. 


e You should restrict access to scanning system records to those whose 
duties require it. So, door staff will only need to see photograph and 
name records to perform their duties whereas a manager or supervisor 
is likely to need access to all record fields, including address. 


e You should carefully consider the location and physical security of the 
scanning equipment, as it is likely to be in close view of customers. 
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You should only keep records for as long as there is a reasonable 
business need to do so. You should regularly delete details relating to 
those who have not visited the premises for a certain period and you 
can programme your system to delete records automatically. Over time 
the age of potential under-age drinkers will no longer be in doubt and 
you should remove their details. Furthermore, the larger the database 
the longer it takes to search and retrieve records, so for business 
efficiency you should carefully manage its size. 


Once verified, you should apply without delay any requests for 
correction of records (Such as change of address). 


You should have procedures in place to handle requests from 
individuals for copies of their personal information - see our separate 
guidance checklist for handling requests for personal information 
(subject access requests). 


ID scanning equipment should have a transactional logging and audit 
Capability to allow regular security reviews to counter any possible 
system abuse. 


More information 


If you need any more information about this or any other aspect of data 
protection, please contact us. 


Phone: 08456 30 60 60 


E-mail: 


01625 54 57 45 


please use the online enquiry form on our website 


Website: www.ico.org.uk 
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